Loading story…
An Iranian security firm reported a firmware-level rootkit targeting HP Integrated Lights Out (iLO) that could repeatedly wipe disks on compromised servers, creating persistent and difficult-to-diagnose outages. The implant was described as operating below the host operating system at the server-management firmware layer, combining stealth and persistence with a destructive wiper capability that could re-destroy the same systems after recovery efforts. Researchers noted the malware’s potential impact on sensitive servers, data centers, and critical infrastructure environments because compromise of iLO can survive conventional remediation on the host.
Open-source reporting tied the activity to attacks affecting organizations in Iran, while separate research associated the campaign with the Indra threat actor. However, public evidence remained limited: reporting cited sparse technical indicators and did not support high-confidence attribution despite at least one artifact reportedly matching the malware’s described behavior. The case highlighted the operational risk of out-of-band management compromise, where attackers can pair firmware persistence with destructive actions to cause recurring service disruption rather than a one-time wipe.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
On 28 December 2021, Iranian security company Amnpardaz Soft published a report describing a firmware-level rootkit targeting HP Integrated Lights Out (iLO) and designed to repeatedly wipe disks on infected systems. The report did not include indicators of compromise, and the available evidence did not support confident attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Handala Hack**, an online persona tied to **Void Manticore** and assessed by multiple researchers as linked to Iran’s **Ministry of Intelligence and Security (MOIS)**, is being tracked for destructive intrusions involving **wiper attacks** and related hack-and-leak activity against organizations in **Israel** and the **United States**. Public reporting cited by Unit 42 says attackers gained access to corporate networks using legitimate user credentials, while recent tradecraft includes phishing, identity compromise, and abuse of administrative access through **Microsoft Intune**. Israel’s National Cyber Directorate warned that several incidents involved deletion of servers and workstations to disrupt operations, reinforcing concern that the current regional conflict is increasing the likelihood of further destructive cyber activity. Technical reporting indicates the actor continues to favor **hands-on-keyboard** operations, multiple wiping methods, and a mix of custom and publicly available tooling. Check Point said newly observed techniques include use of **NetBird** for tunneling and an **AI-assisted PowerShell** script for wiping, while Blackpoint’s advisory highlighted a broader Iranian threat posture featuring credential theft, phishing, password spraying, remote management tools, and exfiltration utilities such as **Rclone**. The combined reporting points to a near-term risk of disruptive attacks focused on identity compromise, lateral movement, data theft, and system destruction, particularly for organizations with exposed services, weak privilege controls, or insufficiently protected administrative accounts.
Jun 29, 2026
Researchers reported that **TeamPCP** has expanded its cloud-native malware operations by adding a destructive payload to its **CanisterWorm** toolkit. The malware checks whether it is running in **Kubernetes** and whether the host appears configured for Iran based on timezone or locale, then selects one of four paths: wiping Iranian Kubernetes environments, deploying the CanisterWorm backdoor in non-Iranian Kubernetes environments, wiping local non-Kubernetes Iranian systems, or doing nothing elsewhere. In Kubernetes, the wiper deploys a **privileged DaemonSet** that mounts the host root filesystem, deletes top-level directories, and forces node reboots, effectively bricking the cluster. Researchers linked the payload to earlier CanisterWorm activity through shared **ICP canister** command-and-control infrastructure, overlapping backdoor code, the `/tmp/pglog` path, and the same DaemonSet-based propagation model. Reporting also said newer variants broaden propagation by harvesting SSH-related data and scanning for exposed Docker APIs on port `2375`, raising the risk of spread across containerized and cloud environments. Defenders were urged to review Kubernetes DaemonSets, suspicious services and file paths, block outbound access to `icp0[.]io` domains, secure Docker APIs, rotate SSH keys, and inspect SSH logs for signs of lateral movement.
Jun 29, 2026
Iran-linked operators allegedly combined **MuddyWater** pre-positioning with **Handala** destructive actions to cripple Stryker by abusing Microsoft Intune rather than deploying ransomware or a conventional wiper. The reports say attackers stole a privileged session, elevated access through an **Entra ID PIM** design gap that accepted an existing MFA claim, and then used Intune API bulk **Wipe** and **Retire** actions to erase about **200,000 devices** across **61 countries**, disrupting roughly **56,000 employees**. Supporting reporting ties the operation to MOIS-linked infrastructure, malware including **Dindoor** and **Fakeset**, and data theft activity using **Rclone** before the destructive phase.
Jul 12, 2026